߲j\. dZddlZddlZddlZddlZddlmZmZddlm Z ddl m Z m Z ejdZGddZd ej"d ed ed efd Zded edzfdZdedededzd efdZd edefdZddd ededed efdZy)u_Blocking gateway approval wait for :mod:`tools.approval`. Mirrors the CLI's synchronous ``input()`` flow: the agent thread enqueues a pending approval, the gateway notifies the user, and the thread blocks until ``/approve`` / ``/deny`` resolves it or the approval timeout elapses. Multiple threads (parallel subagents, execute_code RPC handlers) can block concurrently — each gets its own ``threading.Event``; ``/approve`` resolves the oldest, ``/approve all`` every pending entry. Queue state (``_gateway_queues``, ``_lock``) is owned by ``tools.approval`` and reached through that module at call time. N)get_interrupt_reasonis_interrupted)approval_context)activity_heartbeathuman_wait_windowztools.approvalc eZdZdZdZdefdZy)_ApprovalEntryz@One pending dangerous-command approval inside a gateway session.)eventdataresultreason acknowledgedsettle cancelledr c tj|_t||_|jj dt jjd|_ d|_ d|_ d|_ d|_ y)N request_idF) threadingEventr dictr setdefaultuuiduuid4hexrrr r r)selfr s @/home/ubuntu/.hermes/hermes-agent/tools/approval_gateway_wait.py__init__z_ApprovalEntry.__init__sc__& J  \4::<+;+;<! "& "& &*N)__name__ __module__ __qualname____doc__ __slots__rrrrr r sJ\I *T *rr r session_key interrupt_logreturnctjttjdz}t d}t |5 tr tj|| dddy|tjz }|dkr dddy|jtd|r dddy|~#1swYyxYw) uFWait on *event* until it fires, the turn is interrupted, or approvals.timeout elapses; returns ``"set"`` | ``"interrupted"`` | ``"timeout"``. Polls in ~1s slices so activity heartbeats reach the agent's inactivity tracker every ~10s — otherwise the gateway watchdog kills the agent while the user is still responding (mirrors ``_wait_for_process()`` cadence). The loop is recorded as human-wait time so the concurrent batch deadline excludes it. Any interrupt (/stop, inactivity timeout, delegation teardown) ends the wait fail-closed: the command does not run. Who caused it is read from the per-thread interrupt-cause channel (``get_interrupt_reason()``, a trusted fixed category), never inferred from message text, so the caller can report a withdrawn prompt without inventing a user refusal.rzwaiting for user approvalN interruptedtimeoutg?)r)set) time monotonicmax_ctx_get_approval_timeoutrrrloggerinfowaitmin)r r$r%deadline heartbeat remainings r _poll_eventr7-s~~#d&@&@&BA"FFH"#>?I ; '  M;7$  !4>>#33IA~   zz#c9"5z6   K  s #C 6C C C  Cstatecl|dk(rtxsdS|dk(r|j|jxsdSy)u}Why the wait ended with nobody answering: the turn was interrupted (cause from the per-thread channel — a user /stop or a parent's delegation teardown), the entry was withdrawn with a stamped cause (leader interrupted, session torn down), or the turn ended under the prompt (notifier unregistered, result never set). ``None`` for a real answer or a plain timeout.r(zturn interruptedr*Nz-the turn ended before the prompt was answered)rr r)r8entrys r _cancel_causer;Ls>  #%;);; ~%,,.Q"QQ rpayloadresolvedchoicec |jdrd}n |sdn|xsd}tjdi|d|i||||d|S)zFire the post hook and build the decision dict. Unresolved (timeout) and a None choice both mean the user never answered; ``cancelled`` carries the cause when the prompt was withdrawn rather than answered.rr)r>)r=r>r post_approval_response)getr._fire_approval_hook)r<r=r>r extra hook_choices r_finishrFYsQ yy! '/if6I ^^^X]^ Ff N NNrc tjd i|ddit|j|d}t ||}|dk(rd\}}n|dk(rd\}}n|j }|d u}|d k(ry |rd |ini}t |||t|d d fddi|S)udWait on an already-pending identical approval instead of re-prompting. Adopts the leader's decision: ``session``/``always`` → approval (same dict shape as a direct resolution; persistence stays the caller's and is idempotent across leader and followers); ``deny`` → denial carrying the leader's reason; leader timeout / our own deadline → unresolved. ``once`` returns ``None``: single-use consent covers only the leader's execution, so the caller must issue a fresh prompt. Hooks fire with ``coalesced=True`` so observers see the follower's lifecycle without a duplicate prompt. coalescedTuECoalesced approval wait interrupted — returning deny for session %sr%r()denyTr))NFNoncerr pre_approval_request)r.rCr7r r;r rFgetattr)r$leaderr<r8rr>r=rDs r_await_coalesced_leaderrPes OwO$O  k'F GEeV,I ' ) &% (1[) $rE 7Hfgfh.M gY] gaf ggrgateway)surface approval_datarRc ddlmddlm}m}m}j dd}j ddj dd|tj d|g|d }tj dxsgj5tfd jj gDd } d d d  |st| |} | | Stj5|jjgjd d d d td td zffd } t!j"di| |t%j&|t/j0d} t3| }| dk(r!|_j0j7| | }| dk(rd}| dk7xs|d u}|rd|ini}t9|||j:fi|S#1swYLxYw#1swYxYw#t($rG} t*j-d| | dt!j"di|ddidd ddcYd } ~ Sd } ~ wwxYw)a/Enqueue *approval_data*, notify the user, and block until resolved or timed out. Shared by the terminal command guard, the execute_code guard, the plugin escalation gate, and MCP elicitation. Returns ``{"resolved", "choice", "reason"}`` or ``{"resolved": False, "choice": None, "notify_failed": True}`` when the notify callback raised. Persisting the choice and building the tool-facing result stay with the caller. Identical concurrent approvals (same command text + pattern-key set) are coalesced: parallel tool calls would otherwise fire N identical prompts the user must /approve N times while the agent sits wedged. Followers adopt the leader's ``session``/``always``/``deny``/timeout; a ``once`` covers only the leader, so the follower falls through to a fresh prompt.r)approval)approval_publishedpreparing_terminal_approvalregister_prepared_approval pattern_keycommand description pattern_keys)r[r\rYr]r$rRc3K|]^}|jjdjdk(r/t|jjdxsgk(r|`yw)r[r]N)r rBlist).0erSkeyss r z*_await_gateway_decision..sYKQ&&**Y/=3D3DY3OO > : @bATIKsA$A'Nr8r&cj5j}jjg}|vr|j |sjj dj dc}_ddd|dk(rdnd}n|} ||SS#1swY&xYw#t$rtjddYSwxYw)aLeave the queue and return the choice committed so far. Reading ``entry.result`` and removing the entry are one critical section under the approval lock: ``resolve_gateway_approval`` commits under the same lock, so a choice that landed after the deadline check but before this removal is still ours to honour, and one arriving later finds no entry (the client is told nothing was pending instead of being acked "ok" while the agent denies).Nr*r=session_closedzapproval settle hook failedT)exc_info) _lockr _gateway_queuesrBremovepopr Exceptionr0debug)r8r>queuerr _approvalr:r$s r _drop_entryz,_await_gateway_decision.._drop_entrys __ 6\\F--11+rBE~ U#))--k4@#(<< FEL 6  ~'-'9?O Kv v ) 6 6$ K :T J  KsA0B#B/#B,/ CCz"Gateway approval notify failed: %s notify_failedr>FT)r=r>rpu;Approval wait interrupted — returning deny for session %srIr(rJr)rrLr@)toolsrUagent.terminal_approval_batchrVrWrXrBr_rgnextrhrPr rappendstrr.rCrr rkr0warningr7r r;rr*rFr )r$ notify_cbrSrRrVrWrX primary_keyr<rOadoptedroexcr8rr>r=rDrnr:rbs` ` @@@r_await_gateway_decisionr{sy,yy##M26K $$Y3$((;"]..~ }MN"w G  !!.17R 8D RK)";";"?"? R"PKLPRR"="?)+vwG  N = )E L";6!!,,["=DDUKL33:: ?w?J$uzz"#  [&c eEeU+I #   F  !7V4%7H(1[) $rE 7Hfell De DDKRRLLL J;SAO$   ]W]_]!TDII Js61H?5H)"H)HH&) I92rs  @*K   + ,**(ySCTW>  d  OT OT O3: OSW Ohhth:aj^E^E^EZ]^Enr^Er